Bug 468450

Summary:	php-Smarty: arbitrary code execution due to an error when processing data with embedded variables
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	chris.stone, icon, john
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-10-24 19:41:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2008-10-24 19:18:01 UTC

From Secunia advisory:

A vulnerability has been reported in Smarty, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to an error when processing data with embedded variables. This can be exploited to potentially execute arbitrary PHP code.

This vulnerability is reported in version 2.6.19.

References: 
http://secunia.com/advisories/32329/
http://bugs.gentoo.org/show_bug.cgi?id=243856

Comment 1 Christopher Stone 2008-10-24 19:34:18 UTC

What is the point in opening this bug?  And why did I waste my time creating bug #467317 is this is the bug that is going to be used to track this issue which has already been fixed BTW.

Comment 2 Tomas Hoger 2008-10-24 19:41:23 UTC

Fedora updates updating php-Smarty to fixed upstream version:

  https://admin.fedoraproject.org/updates/F8/FEDORA-2008-8956
  https://admin.fedoraproject.org/updates/F9/FEDORA-2008-8945